Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-53124— net: fix data-races around sk->sk_forward_alloc

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于net组件中sk->sk_forward_alloc在多线程调用tcp_v6_do_rcv/sk_forward_alloc_add时未加锁，导致数据竞争。

CVSS 7.5 · High EPSS 0.59% · P47

Possible ATT&CK Techniques 1 AI

T1135 · Network Share Discovery

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux e994b2f0fb9229aeff5eea9541320bd7b2ca8714< 695fb0b9aecfd5dd5b2946ba8897ac2c1eef654d affected
e994b2f0fb9229aeff5eea9541320bd7b2ca8714< fe2c0bd6d1e29ccefdc978b9a290571c93c27473 affected
e994b2f0fb9229aeff5eea9541320bd7b2ca8714< c3d052cae566ec2285f5999958a5deb415a0f59e affected
e994b2f0fb9229aeff5eea9541320bd7b2ca8714< be7c61ea5f816168c38955eb4e898adc8b4b32fd affected
e994b2f0fb9229aeff5eea9541320bd7b2ca8714< 3f51f8c9d28954cf380100883a02eed35a8277e9 affected
e994b2f0fb9229aeff5eea9541320bd7b2ca8714< d285eb9d0641c8344f2836081b4ccb7b3c5cc1b6 affected
e994b2f0fb9229aeff5eea9541320bd7b2ca8714< 073d89808c065ac4c672c0a613a71b27a80691cb affected
4.4 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-53124

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: fix data-races around sk->sk_forward_alloc
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: fix data-races around sk->sk_forward_alloc Syzkaller reported this warning: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c5/0x1e0 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-rc5 #26 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:inet_sock_destruct+0x1c5/0x1e0 Code: 24 12 4c 89 e2 5b 48 c7 c7 98 ec bb 82 41 5c e9 d1 18 17 ff 4c 89 e6 5b 48 c7 c7 d0 ec bb 82 41 5c e9 bf 18 17 ff 0f 0b eb 83 <0f> 0b eb 97 0f 0b eb 87 0f 0b e9 68 ff ff ff 66 66 2e 0f 1f 84 00 RSP: 0018:ffffc9000008bd90 EFLAGS: 00010206 RAX: 0000000000000300 RBX: ffff88810b172a90 RCX: 0000000000000007 RDX: 0000000000000002 RSI: 0000000000000300 RDI: ffff88810b172a00 RBP: ffff88810b172a00 R08: ffff888104273c00 R09: 0000000000100007 R10: 0000000000020000 R11: 0000000000000006 R12: ffff88810b172a00 R13: 0000000000000004 R14: 0000000000000000 R15: ffff888237c31f78 FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc63fecac8 CR3: 000000000342e000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __warn+0x88/0x130 ? inet_sock_destruct+0x1c5/0x1e0 ? report_bug+0x18e/0x1a0 ? handle_bug+0x53/0x90 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? inet_sock_destruct+0x1c5/0x1e0 __sk_destruct+0x2a/0x200 rcu_do_batch+0x1aa/0x530 ? rcu_do_batch+0x13b/0x530 rcu_core+0x159/0x2f0 handle_softirqs+0xd3/0x2b0 ? __pfx_smpboot_thread_fn+0x10/0x10 run_ksoftirqd+0x25/0x30 smpboot_thread_fn+0xdd/0x1d0 kthread+0xd3/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]--- Its possible that two threads call tcp_v6_do_rcv()/sk_forward_alloc_add() concurrently when sk->sk_state == TCP_LISTEN with sk->sk_lock unlocked, which triggers a data-race around sk->sk_forward_alloc: tcp_v6_rcv tcp_v6_do_rcv skb_clone_and_charge_r sk_rmem_schedule __sk_mem_schedule sk_forward_alloc_add() skb_set_owner_r sk_mem_charge sk_forward_alloc_add() __kfree_skb skb_release_all skb_release_head_state sock_rfree sk_mem_uncharge sk_forward_alloc_add() sk_mem_reclaim // set local var reclaimable __sk_mem_reclaim sk_forward_alloc_add() In this syzkaller testcase, two threads call tcp_v6_do_rcv() with skb->truesize=768, the sk_forward_alloc changes like this: (cpu 1) | (cpu 2) | sk_forward_alloc ... | ... | 0 __sk_mem_schedule() | | +4096 = 4096 | __sk_mem_schedule() | +4096 = 8192 sk_mem_charge() | | -768 = 7424 | sk_mem_charge() | -768 = 6656 ... | ... | sk_mem_uncharge() | | +768 = 7424 reclaimable=7424 | | | sk_mem_uncharge() | +768 = 8192 | reclaimable=8192 | __sk_mem_reclaim() | | -4096 = 4096 | __sk_mem_reclaim() | -8192 = -4096 != 0 The skb_clone_and_charge_r() should not be called in tcp_v6_do_rcv() when sk->sk_state is TCP_LISTEN, it happens later in tcp_v6_syn_recv_sock(). Fix the same issue in dccp_v6_do_rcv().
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于net组件中sk->sk_forward_alloc在多线程调用tcp_v6_do_rcv/sk_forward_alloc_add时未加锁，导致数据竞争。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux e994b2f0fb9229aeff5eea9541320bd7b2ca8714 ~ 695fb0b9aecfd5dd5b2946ba8897ac2c1eef654d -
Linux Linux 4.4 -

II. Public POCs for CVE-2024-53124

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-53124

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-53124 (7)

Same Patch Batch · Linux · 2024-12-02 · 22 CVEs total

CVE-2024-53103 7.8 HIGH hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
CVE-2024-53121 7.8 HIGH net/mlx5: fs, lock FTE when checking if active
CVE-2024-53107 7.8 HIGH fs/proc/task_mmu: prevent integer overflow in pagemap_scan_get_args()
CVE-2024-53109 7.8 HIGH nommu: pass NULL argument to vma_iter_prealloc()
CVE-2024-53122 7.5 HIGH mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
CVE-2024-53120 7.5 HIGH net/mlx5e: CT: Fix null-ptr-deref in add rule err flow
CVE-2024-53110 7.3 HIGH vp_vdpa: fix id_table array not null terminated error
CVE-2024-53108 7.3 HIGH drm/amd/display: Adjust VSDB parser for replay feature
CVE-2024-53106 7.3 HIGH ima: fix buffer overrun in ima_eventdigest_init_common
CVE-2024-53111 7.1 HIGH mm/mremap: fix address wraparound in move_page_tables()
CVE-2024-53119 virtio/vsock: Fix accept_queue memory leak
CVE-2024-53117 virtio/vsock: Improve MSG_ZEROCOPY error handling
CVE-2024-53116 drm/panthor: Fix handling of partial GPU mapping of BOs
CVE-2024-53115 drm/vmwgfx: avoid null_ptr_deref in vmw_framebuffer_surface_create_handle
CVE-2024-53114 x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client
CVE-2024-53113 mm: fix NULL pointer dereference in alloc_pages_bulk_noprof
CVE-2024-53112 ocfs2: uncache inode which has failed entering the group
CVE-2024-53118 vsock: Fix sk_error_queue memory leak
CVE-2024-53105 mm: page_alloc: move mlocked flag clearance into free_pages_prepare()
CVE-2024-53104 media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

Showing top 20 of 22 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-53124

No comments yet

Leave a comment